However, as an open system, FL is vulnerable to malicious participants and there are already studies deep dive into different kinds of attacks for classification models in federated scenarios, like gradient inversion attacks [1]} and backdoor attacks [2]}. In a backdoor attack with classification models, the attacker, such as a malicious client, adds a "trigger" signal to its training data and identifies any image with a "trigger" as other classes [3]}.
A "trigger," such as a small patch with random noise, could lead a sample to be misclassified to another class. We present some example images with backdoor attack triggers in Fig. REF . Unfortunately, the server cannot directly detect the attacked images in FL given the factor of data-silos. This kind of attack takes advantage of the classification model's tendency to overfit the trigger rather than the actual image [2]}. This notion inspires us to think about how we can identify malicious clients in the FedGAN settings.
